SES-36: More Kerberos sample configurations
This commit is contained in:
Mike Wiesner
@@ -0,0 +1,6 @@
|
||||
[libdefaults]
|
||||
default_realm = SPRINGSOURCE.COM
|
||||
[realms]
|
||||
SPRINGSOURCE.COM = {
|
||||
kdc = kdc.springsource.com
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<beans xmlns="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
|
||||
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
|
||||
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
|
||||
|
||||
<!-- This configuration uses SPNEGO by default, but one could also use a form if he directly goes to /login.html -->
|
||||
<sec:http>
|
||||
<sec:intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_FULLY" />
|
||||
<sec:form-login login-page="/login.html" default-target-url="/secure/index.jsp"/>
|
||||
</sec:http>
|
||||
|
||||
<sec:authentication-manager alias="authenticationManager">
|
||||
<sec:authentication-provider ref="kerberosAuthenticationProvider"/>
|
||||
</sec:authentication-manager>
|
||||
|
||||
<bean id="kerberosAuthenticationProvider"
|
||||
class="org.springframework.security.extensions.kerberos.KerberosAuthenticationProvider">
|
||||
<property name="kerberosClient">
|
||||
<bean class="org.springframework.security.extensions.kerberos.SunJaasKerberosClient">
|
||||
<property name="debug" value="true"/>
|
||||
</bean>
|
||||
</property>
|
||||
<property name="userDetailsService" ref="dummyUserDetailsService"/>
|
||||
</bean>
|
||||
|
||||
<bean
|
||||
class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
|
||||
<property name="debug" value="true" />
|
||||
<!-- You can point to a different kerberos config location here, if you don't want the default one -->
|
||||
<!-- <property name="krbConfLocation" value="/etc/krb5.conf"/> -->
|
||||
</bean>
|
||||
|
||||
<!--
|
||||
Just returns the User authenticated by Kerberos and gives him the
|
||||
ROLE_USER
|
||||
-->
|
||||
<bean id="dummyUserDetailsService"
|
||||
class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
|
||||
</beans>
|
||||
@@ -0,0 +1,58 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<beans xmlns="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
|
||||
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
|
||||
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
|
||||
|
||||
<!-- This configuration uses SPNEGO by default, but one could also use a form if he directly goes to /login.html -->
|
||||
<sec:http entry-point-ref="spnegoEntryPoint">
|
||||
<sec:intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_FULLY" />
|
||||
<sec:custom-filter ref="spnegoAuthenticationProcessingFilter"
|
||||
position="BASIC_AUTH_FILTER" />
|
||||
<sec:form-login login-page="/login.html" default-target-url="/secure/index.jsp"/>
|
||||
</sec:http>
|
||||
|
||||
<bean id="spnegoEntryPoint"
|
||||
class="org.springframework.security.extensions.kerberos.web.SpnegoEntryPoint" />
|
||||
|
||||
<bean id="spnegoAuthenticationProcessingFilter"
|
||||
class="org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter">
|
||||
<property name="authenticationManager" ref="authenticationManager" />
|
||||
</bean>
|
||||
|
||||
<sec:authentication-manager alias="authenticationManager">
|
||||
<sec:authentication-provider ref="kerberosServiceAuthenticationProvider" /> <!-- Used with SPNEGO -->
|
||||
<sec:authentication-provider user-service-ref="dummyUserDetailsService"/> <!-- Used with form login -->
|
||||
</sec:authentication-manager>
|
||||
|
||||
|
||||
|
||||
<bean id="kerberosServiceAuthenticationProvider"
|
||||
class="org.springframework.security.extensions.kerberos.KerberosServiceAuthenticationProvider">
|
||||
<property name="ticketValidator">
|
||||
<bean
|
||||
class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
|
||||
<property name="servicePrincipal" value="HTTP/web.springsource.com" />
|
||||
<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
|
||||
<!-- See the Javadoc for more information on that -->
|
||||
<property name="keyTabLocation" value="/etc/web-springsource-com.keytab" />
|
||||
<property name="debug" value="true" />
|
||||
</bean>
|
||||
</property>
|
||||
<property name="userDetailsService" ref="dummyUserDetailsService" />
|
||||
</bean>
|
||||
|
||||
<!-- This bean definition enables a very detailed Kerberos logging -->
|
||||
<bean
|
||||
class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
|
||||
<property name="debug" value="true" />
|
||||
</bean>
|
||||
|
||||
<!--
|
||||
Just returns the User authenticated by Kerberos and gives him the
|
||||
ROLE_USER
|
||||
-->
|
||||
<bean id="dummyUserDetailsService"
|
||||
class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
|
||||
|
||||
</beans>
|
||||
@@ -0,0 +1,66 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<beans xmlns="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security"
|
||||
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
|
||||
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
|
||||
|
||||
<!-- This configuration uses SPNEGO by default, but one could also use a form if he directly goes to /login.html -->
|
||||
<sec:http entry-point-ref="spnegoEntryPoint">
|
||||
<sec:intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_FULLY" />
|
||||
<sec:custom-filter ref="spnegoAuthenticationProcessingFilter" position="BASIC_AUTH_FILTER" />
|
||||
<sec:form-login login-page="/login.html" default-target-url="/secure/index.jsp"/>
|
||||
</sec:http>
|
||||
|
||||
<bean id="spnegoEntryPoint"
|
||||
class="org.springframework.security.extensions.kerberos.web.SpnegoEntryPoint" />
|
||||
|
||||
<bean id="spnegoAuthenticationProcessingFilter"
|
||||
class="org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter">
|
||||
<property name="authenticationManager" ref="authenticationManager" />
|
||||
</bean>
|
||||
|
||||
<sec:authentication-manager alias="authenticationManager">
|
||||
<sec:authentication-provider ref="kerberosServiceAuthenticationProvider" /> <!-- Used with SPNEGO -->
|
||||
<sec:authentication-provider ref="kerberosAuthenticationProvider"/> <!-- Used with form login -->
|
||||
</sec:authentication-manager>
|
||||
|
||||
<bean id="kerberosAuthenticationProvider"
|
||||
class="org.springframework.security.extensions.kerberos.KerberosAuthenticationProvider">
|
||||
<property name="kerberosClient">
|
||||
<bean class="org.springframework.security.extensions.kerberos.SunJaasKerberosClient">
|
||||
<property name="debug" value="true"/>
|
||||
</bean>
|
||||
</property>
|
||||
<property name="userDetailsService" ref="dummyUserDetailsService"/>
|
||||
</bean>
|
||||
|
||||
<bean id="kerberosServiceAuthenticationProvider"
|
||||
class="org.springframework.security.extensions.kerberos.KerberosServiceAuthenticationProvider">
|
||||
<property name="ticketValidator">
|
||||
<bean
|
||||
class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
|
||||
<property name="servicePrincipal" value="HTTP/web.springsource.com" />
|
||||
<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
|
||||
<!-- See the Javadoc for more information on that -->
|
||||
<property name="keyTabLocation" value="/etc/web-springsource-com.keytab" />
|
||||
<property name="debug" value="true" />
|
||||
</bean>
|
||||
</property>
|
||||
<property name="userDetailsService" ref="dummyUserDetailsService" />
|
||||
</bean>
|
||||
|
||||
<bean
|
||||
class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
|
||||
<property name="debug" value="true" />
|
||||
<!-- You can point to a different kerberos config location here, if you don't want the default one -->
|
||||
<!-- <property name="krbConfLocation" value="/etc/krb5.conf"/> -->
|
||||
</bean>
|
||||
|
||||
<!--
|
||||
Just returns the User authenticated by Kerberos and gives him the
|
||||
ROLE_USER
|
||||
-->
|
||||
<bean id="dummyUserDetailsService"
|
||||
class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
|
||||
|
||||
</beans>
|
||||
@@ -22,30 +22,34 @@
|
||||
<sec:authentication-provider ref="kerberosServiceAuthenticationProvider" />
|
||||
</sec:authentication-manager>
|
||||
|
||||
|
||||
|
||||
<bean id="kerberosServiceAuthenticationProvider"
|
||||
class="org.springframework.security.extensions.kerberos.KerberosServiceAuthenticationProvider">
|
||||
<property name="ticketValidator">
|
||||
<bean
|
||||
class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
|
||||
<property name="servicePrincipal" value="HTTP/WEB.FENETRES.MONKEYMACHINE.EU" />
|
||||
<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
|
||||
<!-- See the Javadoc for more information on that -->
|
||||
<property name="keyTabLocation" value="classpath:http-web.keytab" />
|
||||
<property name="debug" value="true"/>
|
||||
<property name="servicePrincipal" value="HTTP/web.springsource.com" />
|
||||
<!-- Setting keyTabLocation to a classpath resource will most likely not work in a Java EE application Server -->
|
||||
<!-- See the Javadoc for more information on that -->
|
||||
<property name="keyTabLocation" value="/etc/web-springsource-com.keytab" />
|
||||
<property name="debug" value="true" />
|
||||
</bean>
|
||||
</property>
|
||||
<property name="userDetailsService" ref="dummyUserDetailsService" />
|
||||
</bean>
|
||||
|
||||
<!-- Just returns the User authenticated by Kerberos and gives him the ROLE_USER -->
|
||||
<bean id="dummyUserDetailsService" class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService"/>
|
||||
|
||||
<bean id="inMemoryUserDetailsService"
|
||||
class="org.springframework.security.core.userdetails.memory.InMemoryDaoImpl">
|
||||
<property name="userProperties">
|
||||
<value>
|
||||
mike@SECPOD.DE=notUsed,ROLE_ADMIN
|
||||
</value>
|
||||
</property>
|
||||
<!-- This bean definition enables a very detailed Kerberos logging -->
|
||||
<bean
|
||||
class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig">
|
||||
<property name="debug" value="true" />
|
||||
</bean>
|
||||
|
||||
<!--
|
||||
Just returns the User authenticated by Kerberos and gives him the
|
||||
ROLE_USER
|
||||
-->
|
||||
<bean id="dummyUserDetailsService"
|
||||
class="org.springframework.security.extensions.kerberos.sample.DummyUserDetailsService" />
|
||||
|
||||
</beans>
|
||||
@@ -12,11 +12,15 @@
|
||||
</filter-mapping>
|
||||
<context-param>
|
||||
<param-name>contextConfigLocation</param-name>
|
||||
<param-value>/WEB-INF/security.xml</param-value>
|
||||
<param-value>/WEB-INF/spnego.xml</param-value>
|
||||
<!-- <param-value>/WEB-INF/spnego-with-form-login.xml</param-value>-->
|
||||
<!-- <param-value>/WEB-INF/spnego-with-server-side-kerberos-option.xml</param-value>-->
|
||||
<!-- <param-value>/WEB-INF/server-side-kerberos.xml</param-value> -->
|
||||
</context-param>
|
||||
|
||||
|
||||
<!-- Bootstraps the root web application context before servlet initialization -->
|
||||
<!-- Bootstraps the root web application context before servlet initialization
|
||||
-->
|
||||
<listener>
|
||||
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
|
||||
</listener>
|
||||
|
||||
@@ -8,5 +8,8 @@
|
||||
</head>
|
||||
<body>
|
||||
<h1>Click <a href="secure/index.jsp">here</a> to attempt SPNEGO authentication.</h1>
|
||||
|
||||
<h1>Click <a href="login.html">here</a> to got to the form based login.</h1>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
18
spring-security-kerberos-sample/src/main/webapp/login.html
Normal file
18
spring-security-kerberos-sample/src/main/webapp/login.html
Normal file
@@ -0,0 +1,18 @@
|
||||
<html><head><title>Login Page</title></head><body onload='document.f.j_username.focus();'>
|
||||
<h3>Login with Username and Password</h3><form name='f' action='/spring-security-kerberos-sample/j_spring_security_check' method='POST'>
|
||||
<ul>
|
||||
<li>With "spnego-with-form-login.xml" active, you can enter any username and password is always "notUsed".</li>
|
||||
<li>With "spnego-with-server-side-kerberos-option.xml" or "server-side-kerberos.xml" active, you can enter any Kerberos user with the corresponding password.</li>
|
||||
<li>The login doesn't work with "spnego.xml" active</li>
|
||||
</ul>
|
||||
You can activate the different configurations in web.xml.
|
||||
|
||||
|
||||
<table>
|
||||
<tr><td>User:</td><td><input type='text' name='j_username' value=''></td></tr>
|
||||
<tr><td>Password:</td><td><input type='password' name='j_password'/></td></tr>
|
||||
<tr><td colspan='2'><input name="submit" type="submit"/></td></tr>
|
||||
<tr><td colspan='2'><input name="reset" type="reset"/></td></tr>
|
||||
</table>
|
||||
</form>
|
||||
</body></html>
|
||||
Reference in New Issue
Block a user